EncoderThinking (ibrahimsaleem/EncoderThinking) is an MCP server listed on the M8ven Trust Index. It scores 74 out of 100, grade C. It declares 2 tools. The publisher has proved control of what we score (Verified Publisher). It is connected through the M8ven GitHub App, so the listing is re-checked on every push.

Back to MCP Trust IndexM8ven
C
Caution
74/100
1 hour ago

EncoderThinking

→ ibrahimsaleem/EncoderThinking

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored

Monitored 0 days · every push re-verified

Who stands behind it

gmail.com (@ibrahimsaleem) · Verified Publisher

Source: github_app_install

Install from

GitHub

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
Are you the publisher? Confirm or correct these findings.
// known CVEs in dependencies3 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.4GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.4GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

lowuuid@11.1.0GHSA-w5hq-g745-h8pq

uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

2/2 tools missing one or more hints — EncoderThinking (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); EncoderThinkingMCP (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint). OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.17.4 (high), @modelcontextprotocol/sdk@1.17.4 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/ibrahimsaleem/encoderthinking?variant=verified)](https://m8ven.ai/mcp/ibrahimsaleem/encoderthinking)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 1ad218dce91467fe8b7e4ec9592e4e8121aeb038
code hash: 837c1b872570c3e48ee6a7de64221aef18e3274debb9f94ef4f468071f9dafdb
verified: 9/10/2026, 3:45:50 PM
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client